1 /*
2 * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 */
23
24 /*
25 * @test
26 * @bug 8215694
27 * @summary keytool cannot generate RSASSA-PSS certificates
28 * @library /test/lib
29 * @modules java.base/sun.security.util
30 * java.base/sun.security.x509
31 * @run main PSS
32 */
33
34 import jdk.test.lib.Asserts;
35 import jdk.test.lib.SecurityTools;
36 import jdk.test.lib.process.OutputAnalyzer;
37 import jdk.test.lib.security.DerUtils;
38 import sun.security.util.ObjectIdentifier;
39 import sun.security.x509.AlgorithmId;
40
41 import java.io.File;
42 import java.security.KeyStore;
43 import java.security.cert.X509Certificate;
44
45 public class PSS {
46
47 public static void main(String[] args) throws Exception {
48
49 genkeypair("p", "-keyalg RSASSA-PSS -sigalg RSASSA-PSS")
50 .shouldHaveExitValue(0);
51
52 genkeypair("a", "-keyalg RSA -sigalg RSASSA-PSS -keysize 2048")
53 .shouldHaveExitValue(0);
54
55 genkeypair("b", "-keyalg RSA -sigalg RSASSA-PSS -keysize 4096")
56 .shouldHaveExitValue(0);
57
58 genkeypair("c", "-keyalg RSA -sigalg RSASSA-PSS -keysize 8192")
59 .shouldHaveExitValue(0);
60
61 KeyStore ks = KeyStore.getInstance(
62 new File("ks"), "changeit".toCharArray());
63
64 check((X509Certificate)ks.getCertificate("p"), "RSASSA-PSS",
65 AlgorithmId.SHA256_oid);
66
67 check((X509Certificate)ks.getCertificate("a"), "RSA",
68 AlgorithmId.SHA256_oid);
69
70 check((X509Certificate)ks.getCertificate("b"), "RSA",
71 AlgorithmId.SHA384_oid);
72
73 check((X509Certificate)ks.getCertificate("c"), "RSA",
74 AlgorithmId.SHA512_oid);
75
76 // More commands
77 kt("-certreq -alias p -sigalg RSASSA-PSS -file p.req")
78 .shouldHaveExitValue(0);
79
80 kt("-gencert -alias a -sigalg RSASSA-PSS -infile p.req -outfile p.cert")
81 .shouldHaveExitValue(0);
82
83 kt("-importcert -alias p -file p.cert")
84 .shouldHaveExitValue(0);
85
86 kt("-selfcert -alias p -sigalg RSASSA-PSS")
87 .shouldHaveExitValue(0);
88 }
89
90 static OutputAnalyzer genkeypair(String alias, String options)
91 throws Exception {
92 return kt("-genkeypair -alias " + alias
93 + " -dname CN=" + alias + " " + options);
94 }
95
96 static OutputAnalyzer kt(String cmd)
97 throws Exception {
98 return SecurityTools.keytool("-storepass changeit -keypass changeit "
99 + "-keystore ks " + cmd);
100 }
101
102 static void check(X509Certificate cert, String expectedKeyAlg,
103 ObjectIdentifier expectedMdAlg) throws Exception {
104 Asserts.assertEQ(cert.getPublicKey().getAlgorithm(), expectedKeyAlg);
105 Asserts.assertEQ(cert.getSigAlgName(), "RSASSA-PSS");
106 DerUtils.checkAlg(cert.getSigAlgParams(), "000", expectedMdAlg);
107 }
108 }